4 ms·
Ahhh, yes I see where you got lost. You are assuming that they either: * Have a team willing to commit to managing CAs as part of the DC/Login infrastructure.
by zaphar 4y ago
Ahhh, yes I see where you got lost. You are assuming that they either:
* Have a team willing to commit to managing CAs as part of the DC/Login infrastructure.
or
* Are actually using something like Vault in their infrastructure.
Common mistake, really.
In all seriousness you would be amazed how many places neither of those things are true for, and additionally how much sheer effort it would take to make them true at those orgs.
- 0xbadcafebee 4y agoIf you have a team that manages a domain, it will take a month to get anything done with them, if they even allow you to get what you need done. If there is a way to make it easier, they aren't interested.
- bravetraveler 4y agoInstead we get to deal with finance for two months to order from a public CA! Before anyone says it, yes we know about LetsEncrypt, and no we cannot use it
- bravetraveler 4y agoIndeed, I am a bit spoiled... I neglected smaller shops where 'not enough people' rings even more true. Where I'm at, we have tons and tons of people, enough to dedicate (and form) teams for things. It admittedly skews my view quite a bit. Here... we don't have enough capable people. I'm also a bit sour at the alternatives. We have certain (publicly visible) certificates that must go through a CA. That's an absolutely painful process that requires about six levels of finance approval -- every year!